# Doubt in ES query

**URL:** <https://discuss.elastic.co/t/doubt-in-es-query/202213>\
**Category:** Elasticsearch\
**Created:** [October 3, 2019, 4:19pm UTC](https://discuss.elastic.co/t/doubt-in-es-query/202213 "2019-10-03T16:19:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joao\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao_daniel/32/50103_2.png) [@Joao\_Daniel](https://discuss.elastic.co/u/Joao_Daniel)\
**Post date:** [October 3, 2019, 4:19pm UTC](https://discuss.elastic.co/t/doubt-in-es-query/202213/1 "2019-10-03T16:19:28Z")

</div>

Hi,

I have an index with has a lot of documents (+100MM). All documents have a field called "code" with has integers as values. I'm trying to retrive documents that have code set to 4732 OR 4756 OR 4758.

If I ran the query like this I got what was expecting.

> POST /myindex-\*/\_search  
> {  
> "query": {  
> "bool": {  
> "should": [  
> { "match": { "event.code": 4732 }},  
> { "match": { "event.code": 4756 }},  
> { "match": { "event.code": 4728 }}  
> ]  
> }  
> }  
> }

However, if I ran the query like this (note the filter parameter) documents with code 4776 appers.

> {  
> "query": {  
> "bool": {  
> "should": [  
> { "match": { "event.code": 4732 }},  
> { "match": { "event.code": 4756 }},  
> { "match": { "event.code": 4728 }}  
> ],  
> "filter": [  
> { "range": { "@timestamp": { "gte": "now-1M", "lt": "now" }}}  
> ]  
> }  
> }  
> }

My question is: Why this happens? My best guest is that all documents that match the criteria (code == 4732,4756,4728) have been retrived then elastic try to deliver documents that best  
match the provided criterias. Am I right? If yes, how should I right this query to avoid it.

PS: I noted that very same happens if I set size to a huge value.

---

<div class="post-metadata">

**Author:** ![Joao\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao_daniel/32/50103_2.png) [@Joao\_Daniel](https://discuss.elastic.co/u/Joao_Daniel)\
**Post date:** [October 3, 2019, 8:53pm UTC](https://discuss.elastic.co/t/doubt-in-es-query/202213/2 "2019-10-03T20:53:37Z")

</div>

I found a solution. I should use:

> terms.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2019, 8:53pm UTC](https://discuss.elastic.co/t/doubt-in-es-query/202213/3 "2019-10-31T20:53:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.